Enable other applications to access users and their identities.
Connect is a set of controls and APIs for allowing other applications to access your users’ identity and resources. Unlike AuthKit’s other features that help users sign into your application, Connect enables other applications to authenticate and access users’ data through secure, managed APIs.
Built on OAuth 2.0 and OpenID Connect, Connect supports common integration patterns out of the box.
Each Connect integration is defined as an Application, which can be created inside the WorkOS Dashboard.
When creating an application, the first step is to choose the type of integration: OAuth or Machine-to-Machine (M2M).
OAuth is the appropriate choice when building web or mobile applications where the actor being authenticated is a User. Integrating with an OAuth application uses the underlying authorization_code OAuth flow, which is supported by many libraries and frameworks out of the box.
Upon successful authorization, the issued tokens contain information about the user who signed in.
M2M is the appropriate choice when the application is a third-party service, such as one of a customer’s applications. Integrating with an M2M application uses the underlying client_credentials flow.
Unlike OAuth applications, the actor being authenticated is not an individual user. Instead, issued access tokens contain an org_id claim representing the customer being granted access via the M2M application.
The M2M application uses its client_id and client_secret to authenticate requests to the application’s API or services.
When using Connect, there are several actors involved with the integration of each Application:
Applications can have up to 5 credentials. These are only shown once upon creation and do not expire. The application client_id and client_secret from a credential can be used to authenticate to the Connect APIs.
When sharing app credentials with an external party, a secure method should be used – such as encrypted email or file sharing – and the recipient should be properly authenticated.